Apple security bounty upgraded

https://security.apple.com/blog/apple-security-bounty-upgraded/

by serhack_ • 4 years ago

263 94 4 years ago

security.apple.com

dagmx• 4 years ago

This is also part of a new Security Research page https://security.apple.com

brian_herman• 4 years ago

Wow the Security research device looks awesome! https://security.apple.com/research-device

ChrisMarshallNY• 4 years ago

They discussed that, at one of the latest dub-dubs. I think last year.

It's basically an "officially cracked" iPhone.

klabb3• 4 years ago

Looking at the list of approved countries.

Israel not present. Probably because of NSO. Quite hilarious.

melony• 4 years ago

I find it funny that most of the true cyber powers are left off the list but India is considered to be “safe choice”. India may be poor but it is hardly lacking in engineering prowess. Apple’s own employees are a testament to that.

LegitShady• 4 years ago

they made their own

bawolff4• 4 years ago

I wonder what the selection criteria was. For example mexico is also not on the list

blinkingled• 4 years ago

Yeah pretty ballsy move! (Android being always like this does put a bit of damper on it - shell, running tools, custom kernels yeah all of that ;)

throwaway290• 4 years ago

Making a separate, 'researcher-friendly' device that is easier to own "without having to bypass its security features" on the surface seems so incredibly in line with Apple's general ethic yet so counter-productive in this particular context...

capableweb2• 4 years ago

Shell access is available, and you can run any tools, choose your own entitlements, and even customize the kernel.

Wow, I want one of this just for fun, sounds like what I want my normal iPhone to be able to do

Have a proven track record of success in finding security issues on Apple platforms, or other modern operating systems and platforms.

Well, that put a stop to my dream...

camkego• 4 years ago

The quote mentioned above can be found here: https://security.apple.com/research-device/

capableweb2• 4 years ago

I think two HN submissions got merged, I think the submission I made my comment to lead directly to that page. At least that's my excuse in case someone asks.

wnissen• 4 years ago

I remember when the iPhone tech remoted into my phone. I knew it had to be technically possible but it is reserved for Apple. Probably a good idea that it's not generally accessible, all my relatives who I recommend use their iPads for banking would be in trouble.

KerrAvon• 4 years ago

What do you mean by “remoted”?

alden5• 4 years ago

it really spooked me when they did that to my mac

omegacharlie• 4 years ago

If you want a potential alternative to the security research device from Apple look into Corellium[1] - startup that emulates iOS on ARM64 server hardware, sued by Apple for copyright claims and survived.

It is a paid product (eg $x/hr cloud billing). Supposedly easier to obtain than the security research device.

[1] https://corellium.com

AJRF2• 4 years ago

Apples copywriters make everything the brand says sound smug. e.g;

"iPad. Loveable. Drawable. Magical"

"iPhone 14 Pro. Pro. Beyond"

And now;

Apple Security Bounty. Upgraded.

movedx2• 4 years ago

They're just better than you... /s hehe

I know what you mean. But I just think they're very proud of their work, ya know?

codetrotter• 4 years ago

I just think they're very proud of their work, ya know?

And for good reason too. Apple is in a league of its own in quality.

tpmoney• 4 years ago

Could be worse. They could write it clickbait style.

"You won't believe what's new in the iPad"

"Pros are jealous of these new iPhone features"

"5 new upgrades to Apple Security Bounty, and you won't believe number 2!"

AJRF2• 4 years ago

By the same merit, could also be a lot better than the lazy copywriting they have now.

londons_explore2• 4 years ago

we’ve grown our team and worked hard to be able to complete an initial evaluation of nearly every report we receive within two weeks, and most within six days.

At other big tech companies, an initial evaluation of a security report will be done in 15 minutes... And if it's important, people will be woken up and a workaround will probably be deployed in a matter of hours...

For example, the Google security bug form[1] says "This option might really get someone out of bed."

[1] https://www.google.com/appserve/security-bugs/m2/new

lapcat• 4 years ago

This statement did seem strange. However, I sent in a report to Apple Product Security a week ago, and I received a personal response within 48 hours saying that they reviewed my report.

st3fan• 4 years ago

This is nonsense. Nobody verifies security reports of any significance in 15 minutes.

londons_explore2• 4 years ago

Not 'verifies'. Simply read the report and decide on the priority.

Filter out the reports saying "The padlock is missing on my gmail" from those that say "If you type TRUE into the gmail login password box, it will let you log in as any user, and 4chan has discovered it".

BeefWellington3• 4 years ago

I have had replies on bug bounty reports in under 10 before. It can and does happen.

Edit: To clarify, especially in cloud environments (which is most stuff these days) it's really not hard for someone to verify something if it's well written.

bilbo0s• 4 years ago

I agree.

There are clearly 2 different levels of "evaluation" at play here.

Being able to "evaluate" every security bug submitted to you in 15 minutes implies relatively insignificant bugs, or it implies that you are not "evaluating" the bugs you claim you are "evaluating".

The first time a report came in on meltdown/spectre/heartbleed whatever, there is no way any serious security researcher could have fully evaluated that report in 15 minutes. Never having seen or heard tell of it previously. Heck, just pulling together the requisite hardware and getting the requisite software on it might take more than 15 minutes. I don't buy that it could be "evaluated" in 15 minutes.

fshbbdssbbgdd• 4 years ago

I imagine there’s people scanning through the reports to see if they look important as they come in. They just won’t respond immediately.

snowwrestler• 4 years ago

Read more carefully, it says “an initial evaluation of nearly every report we receive within two weeks, and most within six days.”

Emphasis mine. What it means is that even reports that fail the initial “oh shit” gut check (which Apple definitely does BTW) will still get worked within 1-2 weeks. That’s pretty good.

runjake• 4 years ago

It's a lot of talk, but I doubt Apple's honesty here.

See also Gui Rambo getting a measly $7,000 for a couple of fairly serious vulnerabilities.

https://news.ycombinator.com/item?id=33348013

twosdai• 4 years ago

Yeah I love the idea of bug bounties, however there is this issue created when the provider cannot offer the most competitive price for bounties. It's no secret that nation states will pay more than Apple will for vulnerabilities.

tornato73• 4 years ago

There's no reason Apple couldn't pay more than nation-states for bug bounties; They have a ridiculous amount of money after all.

In Crypto there exists a service called ImmuneFi, it's essentially a arbitrator between hackers and services offering bug bounties that provides an impartial third party ruling on the payout.

They recently paid out a $10 million bug bounty. That really needs to move into Web2.

concinds• 4 years ago

Under the detailed criteria listed here[0], it seems plain that he qualified for the $50k award when it comes to the Mac vulnerability, and the $25k award for the iOS one. Since they're fundamentally the same flaw, he'd likely only qualify for $50k, not $75k, but Apple still stiffed him of $43k. For shame.

[0] https://security.apple.com/bounty/categories/

fazfq• 4 years ago

Anybody knows how much this costs (if anything)?

oliwary2• 4 years ago

Device attack via physical access: $5,000: Limited extraction of sensitive data from the locked device after first unlock. As an example, you demonstrated the ability to extract some contact information from a user’s locked device after the first unlock.

Uhhh I must be missing something here… I can trivially share a contact via email after my iPhone is unlocked?

radicality• 4 years ago

I believe by “first unlock” they mean a login/unlock right after a reboot. So - turn on device, do first unlock, then lock again. Might be wrong, but afaik the very first unlock after a reboot is bit different then subsequent unlocks (I guess cached memory etc)

oliwary2• 4 years ago

Ahhh I see. Thank you! There goes my dream of the 5000 dollars. ;)

donkeyd2• 4 years ago

Yup. it's exactly this. After first unlock, data is decrypted and loaded into memory. You shouldn't be able to extract it though, without unlocking the device.

dcormier• 4 years ago

They mean that the device is in a state where it’s locked after having been unlocked at least once after booting.

That first unlock after booting decrypts a bunch of things.

lstamour2• 4 years ago

An iPhone requests the user’s password upon restart, this would be referred to as “first unlock”. The reward is for an exploit that takes place against a _locked device_ but only after it has been unlocked once first. As in, an exploit that applies to the Lock Screen when the device was previously unlocked at least once. It is likely easier to trick a locked system into unlocking after it has already been unlocked the first time, due to password storage, credentialed background processes, and so on.

dangrie158• 4 years ago

„Locked device after first unlock“ => the device is locked but was unlocked at least once after boot. I guess this loads some keys from the tpm into ram. Using Face ID for example requires an initial unlock via the users pin

dwaite2• 4 years ago

First unlock means the user entered the PIN to go through the second level of encryption (after Secure Enclave device-level protections of flash).

Without first PIN, most functions don't work because the writable flash areas storing third party apps and user data are still encrypted.

This is also why you have to enter your PIN on reset rather than a biometric; it is far more established to derive a symmetric key from a password than from biometric data.

dangerface• 4 years ago

Do they actually pay out tho? I keep hearing security researchers having difficulty getting these bounties, seems like a great business strategy out source security audits, offer massive pay outs looks good, don't pay out and keep the pot growing larger to look even better.

libdjml• 4 years ago

That would be a terrible business strategy.

If someone comes forward with legitimate good security vulnerabilities and you don’t pay out, you’re massively encouraging them to go to shady brokers next time.

saagarjha• 4 years ago

I hear they do now but it can still be a pain (have to remind the several times, etc.)

isusmelj• 4 years ago

I just hope you get the money transferred to your bank account and not in Apple product vouchers.

MauranKilom• 4 years ago

Off-topic: This thread has a cool id (33363333)!

Apple security bounty upgraded

Related Stories